Cisco: Older Webex apps can infiltrate malicious code
Two versions of the Webex client can execute commands hidden in URLs when a link is opened. This affects all operating systems, says Cisco.
(Image: Valeriya Zankovych/Shutterstock.com)
Anyone using a Webex client for the conferencing software for Cisco in versions 44.6 or 44.7 should urgently update the software. These versions, regardless of the operating system, contain a faulty URL parser. According to the manufacturer, this can ensure that executable files can be downloaded via a prepared invitation link to a Webex conference.
These then run with all the user's rights. It is not clear from Cisco's announcement whether any operating system protection mechanisms are still active. The preliminary CVE classification of the vulnerability is "High" for the risk, with a score of 8.8 out of 10 points. There is no workaround.
Videos by heise
Only the versions of Webex clients mentioned at the beginning are affected; according to Cisco, this does not include version 44.5 and versions prior to this. As of version 44.8, the clients should no longer have the vulnerability. Cisco did not disclose how it could occur and why it only occurs in 44.6 and 44.7. The repaired and current version 44.8 is available on the Cisco download pages.
(nie)
